Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Messenger systems compared by security, privacy, compatibility, and features

docs.google.com

Post reply on HN
Print view View original

61–70 of 242 posts

Re: Messenger systems compared by security, privacy, compatibility, and features

#61

Post by arendtio »

lvh wrote: post #45

This is neat but it has plenty of flaws. I wish the definitions were spelled out. It says Signal isn't "anonymous", which I assume means "uses a phone number to find peers". And it has the usual feature matrix problem: sure XMPP "does E2E". But what does that mean? It supports S/MIME. Do you want S/MIME? (You don't.) It supports OTR, TS and SCIMP too: but you need to be an expert in messaging schemes to understand ho…

Your points are valid but you didn't mention that OMEMO [1] implements Double Ratchet for XMPP. You can find a list of clients which support OMEMO on https://omemo.top

[1] https://en.wikipedia.org/wiki/OMEMO

Re: Messenger systems compared by security, privacy, compatibility, and features

#64

Post by ge0rg »

arendtio wrote: post #42

Well, that is a protocol comparison. A client comparison would be much closer to the real world user experience. Don't get me wrong, I am a huge fan (and daily user) of XMPP, but the best protocol will not be of any use if the clients are too complicated or buggy to use. So yes, XMPP supports audio and video calls but finding two different clients which work on the first try together can be a challenge. Sometimes I w…

We have the XMPP Compliance Suites 2018[0] providing an overview of protocol-level specifications that a modern client or server should implement, and there was recently a nice article[1] for some example use cases.

What is still missing is everything above the wire protocol level. The XSF, being the XMPP Standards Foundation, is guarding the protocols, and things like UX and client interoperability are considered as off-scope. However, there are people interested in these topics as well looking for fresh collaborators.

[0] https://xmpp.org/extensions/xep-0387.html

[1] https://www.erlang-solutions.com/blog/21-xmpp-use-cases-and-...

Re: Messenger systems compared by security, privacy, compatibility, and features

#65

Post by zimbatm »

cbg0 wrote: post #55
lucideer wrote: post #37

As there's pretty obvious bias showing in the values, some methodology would be good to accompany this sheet. e.g. - Telegram: E2E Private: TRUE - WhatsApp: E2E Private: CLAIMED These are either both "true", or both "claimed". Pick one. In particular, what's the definition of the "Open Spec" column? Signal's GPL spec gets a FALSE here so I'm presuming the definition is something along the lines of "Spec produced by o…

The comments specify what "claimed" means: > Not possible to verify as application is closed source. Maintainer could compromise security at any time without detection. I think it's useful to have this differentiation, even though technically you could say E2E is TRUE for both of these.

Even with an open source edition it's hard to link strongly the source code to the resulting APK. How do you know that the generated APK hasn't been built with extra "features"?

For each release, independent people would have to compile the same source code and inspect if there is any differences with the published APK.

One way to make this easier would be to fix the build system so each build with the same source would provide a bit-exact APK file (without timestamps). Then the independent parties just have to check if all of the bits are the same (with a hashing function).

Ideally Google would also publish the hash output of each APK so that it can be checked against another distribution channel on installation.

Re: Messenger systems compared by security, privacy, compatibility, and features

#66

Post by fwn »

codemusings wrote: post #38
enitihas wrote: post #33

Earlier quoted context omitted.

Doesn't WhatsApp do that? ( https://faq.whatsapp.com/en/android/28030015/ )

If I recall correctly Facebook has plans to end E2E encryption in order to serve personalized ads.

Would be very interesting to read more about it. Do you recall where you've learned about it?

Re: Messenger systems compared by security, privacy, compatibility, and features

#67

Post by vader1 »

zimbatm wrote: post #65
cbg0 wrote: post #55

Earlier quoted context omitted.

The comments specify what "claimed" means: > Not possible to verify as application is closed source. Maintainer could compromise security at any time without detection. I think it's useful to have this differentiation, even though technically you could say E2E is TRUE for both of these.

Even with an open source edition it's hard to link strongly the source code to the resulting APK. How do you know that the generated APK hasn't been built with extra "features"? For each release, independent people would have to compile the same source code and inspect if there is any differences with the published APK. One way to make this easier would be to fix the build system so each build with the same source wo…

F-Droid supports reproducible builds and all APK's they serve are built from source.

Re: Messenger systems compared by security, privacy, compatibility, and features

#68

Post by lvh »

arendtio wrote: post #61
lvh wrote: post #45

This is neat but it has plenty of flaws. I wish the definitions were spelled out. It says Signal isn't "anonymous", which I assume means "uses a phone number to find peers". And it has the usual feature matrix problem: sure XMPP "does E2E". But what does that mean? It supports S/MIME. Do you want S/MIME? (You don't.) It supports OTR, TS and SCIMP too: but you need to be an expert in messaging schemes to understand ho…

Your points are valid but you didn't mention that OMEMO [1] implements Double Ratchet for XMPP. You can find a list of clients which support OMEMO on https://omemo.top [1] https://en.wikipedia.org/wiki/OMEMO

That's a fair point, but the fact that there's yet another protocol, not mentioned on the XMPP E2E wiki, kinda plays into the point itself: XMPP has E2E maybe with a bunch of random protocols and the stars (and the people you talk with) need to align _just right_ for all of it to work. I think it would be fair to say that everyone uses WhatsApp and I know what they get, and at this point only XMPP people use XMPP (explicitly) and maybe they get some kind of E2E but who knows which one and what properties that has.

Re: Messenger systems compared by security, privacy, compatibility, and features

#69

Post by akareilly »

Here's another scorecard: https://www.securemessagingapps.com/

The EFF doesn't do recommendations for all users - whether a messenger works for someone depends on their threat model. https://www.eff.org/deeplinks/2018/03/why-we-cant-give-you-r...

Post reply on HN